Numerous threat groups from nations world-wide are actively exploiting the Log4Shell vulnerability in order to gain access into vulnerable companies and organizations. Currently, the Phosphorus threat group from Iran has been seen deploying ransomware operations utilizing the vulnerability against targeted entities of interest to the group. Additionally, HAFNIUM has been discovered using the exploit to enhance their targeting/reconnaissance vectors. Conti, one of the most active ransomware threat groups, has also taken advantage of the exploit and begun working it into their daily operations. Since the discovery of the vulnerability, over sixty (60) different variations of the exploit have been utilized in the wild thus far, mostly linked to crypto-mining attacks, DDoS botnets, and alternating common malware scripts. Due to the severity and commonality of the vulnerability, numerous critical infrastructure industries (such as electric, water, food & beverage, transportation, and manufacturing) are at a significant risk until appropriate remediation is carried out, making them susceptible targets for threat actors. Since the disclosure of Log4Shell, there have been over 1.8 million recorded exploit attempts of the vulnerability, with numbers expected to rise even further. CTIX is actively monitoring threat groups leveraging this vulnerability and will provide updates as needed.